Policy 7230A - Department of Administration

4. Access Control
These Assessment and Planning Non-Mandatory Procedures support the Enterprise Security
Policy (ITEC 7230 Rev 1).
Mandatory
Non-Mandatory
Procedures Baselines Procedures Baselines
4. Access Control
4.1. Identification and Authentication
4.1.1. Manage Identification and Authentication (6 sets) (4 sets)
4.2. Account Management
4.2.1. Configure User Accounts (4 sets) (2 sets)
4.3. Session Management
4.3.1. Configure Systems for Secure Access (6 sets) (3 sets)
4.3.2. Configure Systems for Secure Communications (3 sets) (1 set)
4.4. Maintain Records
4.1. Identification and Authentication
No applicable Non-Mandatory Procedures.
4.2. Account Management
The following are the Non-Mandatory Procedures that support the Account
Management section of the Default Security Requirements:
4.2.1. Configure User Accounts
Agencies should establish the system accounts that will be used to access
system in a manner that promotes and enhances security while maintaining
business functionality:
4.2.1.1 Create User Accounts to Optimize Security
Users must be provided accounts for all systems that they require
access to however those accounts must be created in a manner that
enhances and enforces organizational security requirements:
• Accounts must be created with the minimal set of permissions
(also know as least privilege) as required by positional role.
• Accounts must be created with the minimal set of
responsibilities (also known as job segregation) as required by
positional role.
• Accounts must be configured to require the use of unique
identifiers and authenticators.
• Accounts must be configured to enforce system lockout in the
event of failed authentication.
7